Skip to content

Commit bbfc2dc

Browse files
zpavlinovicgopherbot
zpavlinovic
authored and
gopherbot
committed
data/reports: add 3 reports
 - data/reports/GO-2024-2980.yaml - data/reports/GO-2024-2981.yaml - data/reports/GO-2024-2982.yaml Fixes #2980 Fixes #2981 Fixes #2982 Change-Id: Ic6a3314c0a9ab2d8dc1f71a11437ef1f380ac466 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/597995 Auto-Submit: Zvonimir Pavlinovic <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Tatiana Bradley <[email protected]>
1 parent 3a021f5 commit bbfc2dc

File tree

6 files changed

+286
-0
lines changed

6 files changed

+286
-0
lines changed

‎data/osv/GO-2024-2980.json

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2980",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2022-29946",
8+
"GHSA-2h2x-8hh2-mfq8"
9+
],
10+
"summary": "NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects in github.com/nats-io/nats-server",
11+
"details": "NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects in github.com/nats-io/nats-server",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/nats-io/nats-server",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
},
30+
{
31+
"package": {
32+
"name": "github.com/nats-io/nats-server/v2",
33+
"ecosystem": "Go"
34+
},
35+
"ranges": [
36+
{
37+
"type": "SEMVER",
38+
"events": [
39+
{
40+
"introduced": "0"
41+
},
42+
{
43+
"fixed": "2.8.2"
44+
}
45+
]
46+
}
47+
],
48+
"ecosystem_specific": {}
49+
},
50+
{
51+
"package": {
52+
"name": "github.com/nats-io/nats-streaming-server",
53+
"ecosystem": "Go"
54+
},
55+
"ranges": [
56+
{
57+
"type": "SEMVER",
58+
"events": [
59+
{
60+
"introduced": "0"
61+
},
62+
{
63+
"fixed": "0.24.6"
64+
}
65+
]
66+
}
67+
],
68+
"ecosystem_specific": {}
69+
}
70+
],
71+
"references": [
72+
{
73+
"type": "ADVISORY",
74+
"url": "https://github.com/advisories/GHSA-2h2x-8hh2-mfq8"
75+
},
76+
{
77+
"type": "ADVISORY",
78+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29946"
79+
},
80+
{
81+
"type": "WEB",
82+
"url": "https://github.com/nats-io/advisories/blob/main/CVE/CVE-2022-29946.txt"
83+
}
84+
],
85+
"database_specific": {
86+
"url": "https://pkg.go.dev/vuln/GO-2024-2980",
87+
"review_status": "UNREVIEWED"
88+
}
89+
}

‎data/osv/GO-2024-2981.json

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2981",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-39909",
8+
"GHSA-5248-h45p-9pgw"
9+
],
10+
"summary": "SQL Injection in the KubeClarity REST API in github.com/openclarity/kubeclarity/backend",
11+
"details": "SQL Injection in the KubeClarity REST API in github.com/openclarity/kubeclarity/backend",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/openclarity/kubeclarity/backend",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.0.0-20240711173334-1d1178840703"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/openclarity/kubeclarity/security/advisories/GHSA-5248-h45p-9pgw"
38+
},
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/openclarity/kubeclarity/blob/main/backend/pkg/database/id_view.go#L79"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/openclarity/kubeclarity/commit/1d1178840703a72d9082b7fc4aea0a3326c5d294"
46+
}
47+
],
48+
"database_specific": {
49+
"url": "https://pkg.go.dev/vuln/GO-2024-2981",
50+
"review_status": "UNREVIEWED"
51+
}
52+
}

‎data/osv/GO-2024-2982.json

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2982",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-6468",
8+
"GHSA-2qmw-pvf7-4mw6"
9+
],
10+
"summary": "Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions in github.com/hashicorp/vault",
11+
"details": "Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions in github.com/hashicorp/vault.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/hashicorp/vault before v1.15.12.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/hashicorp/vault",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "1.16.0-rc1"
24+
},
25+
{
26+
"fixed": "1.16.3"
27+
},
28+
{
29+
"introduced": "1.17.0-rc1"
30+
},
31+
{
32+
"fixed": "1.17.2"
33+
}
34+
]
35+
}
36+
],
37+
"ecosystem_specific": {
38+
"custom_ranges": [
39+
{
40+
"type": "ECOSYSTEM",
41+
"events": [
42+
{
43+
"introduced": "0"
44+
},
45+
{
46+
"fixed": "1.15.12"
47+
}
48+
]
49+
}
50+
]
51+
}
52+
}
53+
],
54+
"references": [
55+
{
56+
"type": "ADVISORY",
57+
"url": "https://github.com/advisories/GHSA-2qmw-pvf7-4mw6"
58+
},
59+
{
60+
"type": "ADVISORY",
61+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6468"
62+
},
63+
{
64+
"type": "WEB",
65+
"url": "https://discuss.hashicorp.com/t/hcsec-2024-14-vault-vulnerable-to-denial-of-service-when-setting-a-proxy-protocol-behavior/68518"
66+
}
67+
],
68+
"database_specific": {
69+
"url": "https://pkg.go.dev/vuln/GO-2024-2982",
70+
"review_status": "UNREVIEWED"
71+
}
72+
}

‎data/reports/GO-2024-2980.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
id: GO-2024-2980
2+
modules:
3+
- module: github.com/nats-io/nats-server
4+
vulnerable_at: 1.4.1
5+
- module: github.com/nats-io/nats-server/v2
6+
versions:
7+
- fixed: 2.8.2
8+
vulnerable_at: 2.8.1
9+
- module: github.com/nats-io/nats-streaming-server
10+
versions:
11+
- fixed: 0.24.6
12+
vulnerable_at: 0.24.5
13+
summary: |-
14+
NATS Server and Streaming Server fails to enforce negative user permissions, may
15+
allow denied subjects in github.com/nats-io/nats-server
16+
cves:
17+
- CVE-2022-29946
18+
ghsas:
19+
- GHSA-2h2x-8hh2-mfq8
20+
references:
21+
- advisory: https://github.com/advisories/GHSA-2h2x-8hh2-mfq8
22+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2022-29946
23+
- web: https://github.com/nats-io/advisories/blob/main/CVE/CVE-2022-29946.txt
24+
source:
25+
id: GHSA-2h2x-8hh2-mfq8
26+
created: 2024-07-12T16:33:37.628744846Z
27+
review_status: UNREVIEWED

‎data/reports/GO-2024-2981.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
id: GO-2024-2981
2+
modules:
3+
- module: github.com/openclarity/kubeclarity/backend
4+
versions:
5+
- fixed: 0.0.0-20240711173334-1d1178840703
6+
summary: SQL Injection in the KubeClarity REST API in github.com/openclarity/kubeclarity/backend
7+
cves:
8+
- CVE-2024-39909
9+
ghsas:
10+
- GHSA-5248-h45p-9pgw
11+
references:
12+
- advisory: https://github.com/openclarity/kubeclarity/security/advisories/GHSA-5248-h45p-9pgw
13+
- web: https://github.com/openclarity/kubeclarity/blob/main/backend/pkg/database/id_view.go#L79
14+
- web: https://github.com/openclarity/kubeclarity/commit/1d1178840703a72d9082b7fc4aea0a3326c5d294
15+
notes:
16+
- fix: 'github.com/openclarity/kubeclarity/backend: could not add vulnerable_at: cannot auto-guess when fixed version is 0.0.0 pseudo-version'
17+
source:
18+
id: GHSA-5248-h45p-9pgw
19+
created: 2024-07-12T16:33:34.102123356Z
20+
review_status: UNREVIEWED

‎data/reports/GO-2024-2982.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
id: GO-2024-2982
2+
modules:
3+
- module: github.com/hashicorp/vault
4+
versions:
5+
- introduced: 1.16.0-rc1
6+
- fixed: 1.16.3
7+
- introduced: 1.17.0-rc1
8+
- fixed: 1.17.2
9+
non_go_versions:
10+
- fixed: 1.15.12
11+
vulnerable_at: 1.17.1
12+
summary: |-
13+
Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional
14+
Conditions in github.com/hashicorp/vault
15+
cves:
16+
- CVE-2024-6468
17+
ghsas:
18+
- GHSA-2qmw-pvf7-4mw6
19+
references:
20+
- advisory: https://github.com/advisories/GHSA-2qmw-pvf7-4mw6
21+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-6468
22+
- web: https://discuss.hashicorp.com/t/hcsec-2024-14-vault-vulnerable-to-denial-of-service-when-setting-a-proxy-protocol-behavior/68518
23+
source:
24+
id: GHSA-2qmw-pvf7-4mw6
25+
created: 2024-07-12T16:33:28.734714977Z
26+
review_status: UNREVIEWED

0 commit comments

Comments
 (0)